Implement the same SSL features as PyMongo, MOTOR-4.

Jibola · Dec 23, 2013 · bb941d7 · bb941d7
1 parent 46a1dd0
commit bb941d7
Show file tree

Hide file tree

Showing 5 changed files with 461 additions and 35 deletions.
diff --git a/motor/__init__.py b/motor/__init__.py
@@ -172,14 +172,16 @@ def __init__(
             self, sock, io_loop, use_ssl,
             certfile, keyfile, ca_certs, cert_reqs):
         self.use_ssl = use_ssl
-        self.certfile = certfile
-        self.keyfile = keyfile
-        self.ca_certs = ca_certs
-        self.cert_reqs = cert_reqs
         self.timeout = None
         if self.use_ssl:
-            # TODO: use full SSL options.
-            self.stream = iostream.SSLIOStream(sock, io_loop=io_loop)
+            ssl_options = {
+                'certfile': certfile,
+                'keyfile': keyfile,
+                'ca_certs': ca_certs,
+                'cert_reqs': cert_reqs}
+
+            self.stream = iostream.SSLIOStream(
+                sock, ssl_options=ssl_options, io_loop=io_loop)
         else:
             self.stream = iostream.IOStream(sock, io_loop=io_loop)
 
@@ -195,12 +197,13 @@ def settimeout(self, timeout):
         self.timeout = timeout
 
     @motor_sock_method
-    def connect(self, pair, callback):
+    def connect(self, pair, server_hostname=None, callback=None):
         """
         :Parameters:
          - `pair`: A tuple, (host, port)
         """
-        self.stream.connect(pair, callback)
+        # 'server_hostname' is used for optional certificate validation.
+        self.stream.connect(pair, callback, server_hostname=server_hostname)
 
     def sendall(self, data):
         assert greenlet.getcurrent().parent, "Should be on child greenlet"
@@ -371,7 +374,7 @@ def create_connection(self):
                 # Important to increment the count before beginning to connect.
                 self.motor_sock_counter += 1
                 # MotorSocket pauses this greenlet and resumes when connected.
-                motor_sock.connect(sa)
+                motor_sock.connect(sa, server_hostname=host)
                 return motor_sock
             except socket.error, e:
                 self.motor_sock_counter -= 1

diff --git a/test/__init__.py b/test/__init__.py
@@ -39,7 +39,13 @@
 host = os.environ.get("DB_IP", "localhost")
 port = int(os.environ.get("DB_PORT", 27017))
 
+CERT_PATH = os.path.join(
+    os.path.dirname(os.path.realpath(__file__)), 'certificates')
+CLIENT_PEM = os.path.join(CERT_PATH, 'client.pem')
+CA_PEM = os.path.join(CERT_PATH, 'ca.pem')
+
 mongod_started_with_ssl = False
+mongod_validates_client_cert = False
 sync_cx = None
 sync_db = None
 sync_collection = None
@@ -54,6 +60,7 @@
 
 def setup_package():
     global mongod_started_with_ssl
+    global mongod_validates_client_cert
     global sync_cx
     global sync_db
     global sync_collection
@@ -78,11 +85,21 @@ def setup_package():
 
         mongod_started_with_ssl = True
     except pymongo.errors.ConnectionFailure:
-        sync_cx = pymongo.MongoClient(
-            host, port,
-            connectTimeoutMS=connectTimeoutMS,
-            socketTimeoutMS=socketTimeoutMS,
-            ssl=False)
+        try:
+            sync_cx = pymongo.MongoClient(
+                host, port,
+                connectTimeoutMS=connectTimeoutMS,
+                socketTimeoutMS=socketTimeoutMS,
+                ssl_certfile=CLIENT_PEM)
+
+            mongod_started_with_ssl = True
+            mongod_validates_client_cert = True
+        except pymongo.errors.ConnectionFailure:
+            sync_cx = pymongo.MongoClient(
+                host, port,
+                connectTimeoutMS=connectTimeoutMS,
+                socketTimeoutMS=socketTimeoutMS,
+                ssl=False)
 
     sync_db = sync_cx.motor_test
     sync_collection = sync_db.test_collection

diff --git a/test/certificates/ca.pem b/test/certificates/ca.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICnTCCAgYCCQD4+RCKzwZr/zANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMC
+VVMxETAPBgNVBAgMCE5ldyBZb3JrMRYwFAYDVQQHDA1OZXcgWW9yayBDaXR5MQ4w
+DAYDVQQKDAUxMEdlbjEPMA0GA1UECwwGS2VybmVsMRowGAYDVQQDDBFNeSBDZXJ0
+IEF1dGhvcml0eTEbMBkGCSqGSIb3DQEJARYMcm9vdEBsYXphcnVzMB4XDTEzMTEz
+MDAyMzU0OVoXDTIzMTEyODAyMzU0OVowgZIxCzAJBgNVBAYTAlVTMREwDwYDVQQI
+DAhOZXcgWW9yazEWMBQGA1UEBwwNTmV3IFlvcmsgQ2l0eTEOMAwGA1UECgwFMTBH
+ZW4xDzANBgNVBAsMBktlcm5lbDEaMBgGA1UEAwwRTXkgQ2VydCBBdXRob3JpdHkx
+GzAZBgkqhkiG9w0BCQEWDHJvb3RAbGF6YXJ1czCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEA1xymeY+U/evUuQvxpun9moe4GopN80c1ptmaAHM/1Onwaq54Wt27
+nl1wUVme3dh4DdWviYY7mJ333HVEnp/QhVcT4kQhICZqdgPKPdCseQW3H+8x6Gwz
+hrNRBdz0NkSoFxDlIymfy2Q2xoQpbCGAg+EnRYUTKlHMXNpUDLFhGjcCAwEAATAN
+BgkqhkiG9w0BAQUFAAOBgQDRQB3c/9osTexEzMPHyMGTzG5nGwy8Wv77GgW3BETM
+hECoGqueXLa5ZgvealJrnMHNKdj6vrCGgBDzE0K0VdXc4dLtLmx3DRntDOAWKJdB
+2XPMvdC7Ec//Fwep/9emz0gDiJrTiEpL4p74+h+sp4Xy8cBokQ3Ss5S9NmnPXT7E
+qQ==
+-----END CERTIFICATE-----
diff --git a/test/certificates/client.pem b/test/certificates/client.pem
@@ -0,0 +1,101 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7 (0x7)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=New York, L=New York City, O=10Gen, OU=Kernel, CN=My Cert Authority/emailAddress=root@lazarus
+        Validity
+            Not Before: Aug 23 14:55:32 2013 GMT
+            Not After : Jan  7 14:55:32 2041 GMT
+        Subject: C=US, ST=New York, L=New York City, O=10Gen, OU=kerneluser, CN=client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ba:16:42:d4:8b:3d:5e:8a:67:9e:a7:c0:cd:4a:
+                    9c:9c:fd:95:b9:83:bf:f4:cf:03:8c:2e:db:a9:c1:
+                    35:58:80:f6:e2:e9:87:28:84:e3:d0:9b:68:60:51:
+                    0e:42:84:d8:6f:e8:34:cc:18:97:79:d3:8d:d8:2f:
+                    23:11:25:6f:69:7a:38:bb:8c:b2:29:e9:91:be:79:
+                    8c:cc:1b:56:98:98:d3:83:2a:c5:f9:9c:86:0c:2c:
+                    24:0e:5c:46:3b:a9:95:44:6c:c5:e0:7c:9d:03:ae:
+                    0d:23:99:49:a4:48:dd:0e:35:a2:e5:b4:8b:86:bd:
+                    c0:c8:ce:d5:ac:c4:36:f3:9e:5f:17:00:23:8d:53:
+                    a1:43:1b:a3:61:96:36:80:4d:35:50:b5:8b:69:31:
+                    39:b4:63:8b:96:59:5c:d1:ea:92:eb:eb:fa:1b:35:
+                    64:44:b3:f6:f3:a6:9d:49:3a:59:e5:e1:c2:cb:98:
+                    be:29:b3:22:dd:33:97:d7:50:4f:db:c2:58:64:18:
+                    b5:8c:3c:6b:2d:21:f6:bd:8d:e5:d2:da:8d:79:fe:
+                    a7:80:75:a8:15:b9:ee:79:7f:01:31:1d:e5:e7:15:
+                    76:53:65:f6:fe:f0:93:7d:20:3d:cc:ff:9b:ca:b2:
+                    50:2c:1b:3a:69:d5:e6:70:cf:ac:be:7e:5c:33:c4:
+                    6e:a7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints:
+                CA:FALSE
+            Netscape Comment:
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier:
+                4A:8B:EE:22:42:E6:F8:62:4C:86:38:8D:C5:78:95:98:C1:10:05:7C
+            X509v3 Authority Key Identifier:
+                keyid:07:41:19:3A:9F:7E:C5:B7:22:4E:B7:BC:D5:DF:E4:FC:09:B8:64:16
+
+    Signature Algorithm: sha1WithRSAEncryption
+        13:13:a8:f0:de:78:c6:b1:e0:85:cc:27:e6:04:28:44:93:1d:
+        f1:ff:5e:81:69:33:1f:f3:76:e0:49:ca:d9:ad:aa:db:f5:a5:
+        f8:a6:50:bb:a1:a7:40:14:e4:2f:8d:b8:21:7f:35:04:60:db:
+        af:f0:9e:dd:a1:ca:0b:7f:03:2e:2f:19:1e:32:6e:1e:2d:87:
+        68:e3:37:47:a8:5b:93:d1:88:41:73:da:88:21:59:27:d4:35:
+        1c:6a:27:b5:c0:c6:17:ba:f3:87:c8:e1:f4:8f:43:12:bc:fa:
+        8d:90:d5:86:83:df:51:a5:c9:e0:92:f0:66:d0:37:61:6f:85:
+        24:18
+-----BEGIN CERTIFICATE-----
+MIIDdjCCAt+gAwIBAgIBBzANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVVMx
+ETAPBgNVBAgMCE5ldyBZb3JrMRYwFAYDVQQHDA1OZXcgWW9yayBDaXR5MQ4wDAYD
+VQQKDAUxMEdlbjEPMA0GA1UECwwGS2VybmVsMRowGAYDVQQDDBFNeSBDZXJ0IEF1
+dGhvcml0eTEbMBkGCSqGSIb3DQEJARYMcm9vdEBsYXphcnVzMB4XDTEzMDgyMzE0
+NTUzMloXDTQxMDEwNzE0NTUzMlowbjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5l
+dyBZb3JrMRYwFAYDVQQHDA1OZXcgWW9yayBDaXR5MQ4wDAYDVQQKDAUxMEdlbjET
+MBEGA1UECwwKa2VybmVsdXNlcjEPMA0GA1UEAwwGY2xpZW50MIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhZC1Is9XopnnqfAzUqcnP2VuYO/9M8DjC7b
+qcE1WID24umHKITj0JtoYFEOQoTYb+g0zBiXedON2C8jESVvaXo4u4yyKemRvnmM
+zBtWmJjTgyrF+ZyGDCwkDlxGO6mVRGzF4HydA64NI5lJpEjdDjWi5bSLhr3AyM7V
+rMQ2855fFwAjjVOhQxujYZY2gE01ULWLaTE5tGOLlllc0eqS6+v6GzVkRLP286ad
+STpZ5eHCy5i+KbMi3TOX11BP28JYZBi1jDxrLSH2vY3l0tqNef6ngHWoFbnueX8B
+MR3l5xV2U2X2/vCTfSA9zP+byrJQLBs6adXmcM+svn5cM8RupwIDAQABo3sweTAJ
+BgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0
+aWZpY2F0ZTAdBgNVHQ4EFgQUSovuIkLm+GJMhjiNxXiVmMEQBXwwHwYDVR0jBBgw
+FoAUB0EZOp9+xbciTre81d/k/Am4ZBYwDQYJKoZIhvcNAQEFBQADgYEAExOo8N54
+xrHghcwn5gQoRJMd8f9egWkzH/N24EnK2a2q2/Wl+KZQu6GnQBTkL424IX81BGDb
+r/Ce3aHKC38DLi8ZHjJuHi2HaOM3R6hbk9GIQXPaiCFZJ9Q1HGontcDGF7rzh8jh
+9I9DErz6jZDVhoPfUaXJ4JLwZtA3YW+FJBg=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC6FkLUiz1eimee
+p8DNSpyc/ZW5g7/0zwOMLtupwTVYgPbi6YcohOPQm2hgUQ5ChNhv6DTMGJd5043Y
+LyMRJW9peji7jLIp6ZG+eYzMG1aYmNODKsX5nIYMLCQOXEY7qZVEbMXgfJ0Drg0j
+mUmkSN0ONaLltIuGvcDIztWsxDbznl8XACONU6FDG6NhljaATTVQtYtpMTm0Y4uW
+WVzR6pLr6/obNWREs/bzpp1JOlnl4cLLmL4psyLdM5fXUE/bwlhkGLWMPGstIfa9
+jeXS2o15/qeAdagVue55fwExHeXnFXZTZfb+8JN9ID3M/5vKslAsGzpp1eZwz6y+
+flwzxG6nAgMBAAECggEBALYw92urjAFVFxCiA8W7aEzYhtAkaztft4R3mD/C19z4
+H0CZDeig+3+RuIactY5xDIu8WHz/EseHVlg0BmxSL5ugu4z8uq8IbNaFoVFw7r7m
+2ieRKFY0ZpXiXcbllynw5iEhMjeRKhWhQmH5Qb2kTTINV5j4xKa+f9Lblx7Y2Uh4
+tsaOtlMwb98D2/KYJdTv5Nj1nyuSqRVhECsd00Cb6JUBGQBx8Ja0wFy9gEygq6kU
+w3s1XNOSnYNEo4FaVZwp5KZyCyBENcKpNUq4nXt/7ncEfVYdJck0Li3wN4Jr2J9S
+eHqRzh8QkHxc1Ro8ktcXaUSs9kFuwvVvb4rcGUpOMWkCgYEA9xxp8yDtFVgzMtc/
+vS8xgM1Wj4SrgKKYhE2wS05BJh/41oFMzfH1FpZ1GCM983r4QgYWoT71XsBgiOMC
+yN2p2IbV4V44bMGKJqaVMkB91CVCUWI6piaCQb/1CJTwaXE7zPim6dlUSxxBBnRn
+LP50NTscRLFcCZELD3Yl7jR8XFUCgYEAwMfkNFmGtBKAwlHZ3Y3XOwPWg+jCll7s
+9nhv8TU2IB9pcCRGqyOT7k1YymvYkDT2Je4JUPWEBs4cW7yD61LrQ8w8+DrE9dGo
+czzGPyjOAANSX0asG74UjkNIQThmyEOltVHIxYMaSqowjHRSPdA+R4Od9EdcDdfS
+q5SfSVFxmwsCgYBtl1thqUOcCL7EGHQ7KdfxgJ+YDMWmyfWMD4xVCYKZLurD7xop
+59nDR7zslIygE/RQC7Uzk+FsQTNO4ibVAIGX9syaI5gwm3DyjURzwehMEq4ju8W4
+9DEmicRZJvysNrzHvasA4RKiMQihnTQ43yyYgvuZd3MTBxF5rPNLfll89QKBgQC9
+SsmiOZIR+OUjaTmS2bbQBNm7Fm8TNcxZyzKn1wb5jb57VbNqUfnskVgxEqpIFyjn
+X48YRqtH/1RLI5UpGXdXUBFB8Hr7oM1VsgQ7ejakPp7AXOWcLA2FDz3AhMAvvnTU
+0KRihHPpgqk/EOy8M2Ej2XHcrcEO+q+quLmbRXRWtwKBgHacQiwci/2J+v0e9i52
+re/2AJHKP5MwNHFe1e01iNc5EEN0G+/Ut8XW19DWf6bsxqie0ChC+xN8TUst8alT
+F+tXTsHHmt/lRcjTROjT5XVuoqjtU2Q0QeVeGLgvObso+fZy3ZNeQuSJjWukdMZ3
+57rGT6p0OuM8qbrTzpv3JMrm
+-----END PRIVATE KEY-----